Getting Data In

How to extract xml value having multiple same child tag?

Vkeshar
Loves-to-Learn

I have  following sample  XML event where I want to extract specific value for a child tag . Ex when <Order fact> value is 'Place' then extract <Orderupdatevalue> which is false

<OrderUpdateField>
     <OrderFacts>Place</OrderFacts>
     <OrderDataType>String</OrderDataType>
      <OrderUpdateValue>False</OrderUpdateValue>
     <OrderFacts>Number</OrderFacts>
     <OrderDataType>Integer</OrderDataType>
     <OrderUpdateValue>1</OrderUpdateValue>
     <OrderFacts>Location</OrderFacts>
    <OrderDataType>String</OrderDataType>
    <OrderUpdateValue>Earth</OrderUpdateValue>
</OrderUpdateField>

Labels (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Vkeshar 

It looks like you need the first value from multivalued data.

Can you please try this?

YOUR_SEARCH | spath
| eval OrderFacts=mvindex('OrderUpdateField.OrderFacts',0), OrderUpdateValue=mvindex('OrderUpdateField.OrderUpdateValue',0)
| table OrderFacts OrderUpdateValue

My Sample Search :

| makeresults | eval _raw="<OrderUpdateField>
     <OrderFacts>Place</OrderFacts>
     <OrderDataType>String</OrderDataType>
      <OrderUpdateValue>False</OrderUpdateValue>
     <OrderFacts>Number</OrderFacts>
     <OrderDataType>Integer</OrderDataType>
     <OrderUpdateValue>1</OrderUpdateValue>
     <OrderFacts>Location</OrderFacts>
    <OrderDataType>String</OrderDataType>
    <OrderUpdateValue>Earth</OrderUpdateValue>
</OrderUpdateField>" | spath
| eval OrderFacts=mvindex('OrderUpdateField.OrderFacts',0), OrderUpdateValue=mvindex('OrderUpdateField.OrderUpdateValue',0)
| table OrderFacts OrderUpdateValue

 

Screenshot 2022-09-27 at 10.54.02 AM.png

 

I hope this will help you.

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated. 
 

0 Karma
Get Updates on the Splunk Community!

Raise Your Skills at the .conf25 Builder Bar: Your Splunk Developer Destination

Calling all Splunk developers, custom SPL builders, dashboarders, and Splunkbase app creators – the Builder ...

Hunt Smarter, Not Harder: Discover New SPL “Recipes” in Our Threat Hunting Webinar

Are you ready to take your threat hunting skills to the next level? As Splunk community members, you know the ...

Splunk ITSI & Correlated Network Visibility

  Now On Demand   Take Your Network Visibility to the Next Level In today’s complex IT environments, ...